Linux kernel (drivers/vfio): Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to a

Impact

Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to a huge unsigned value on unmap. A tenant that maps DMA, execs, and repeats sheds its RLIMIT_MEMLOCK charge each round and can pin host RAM without bound until the node runs out of memory - a noisy-neighbour outage for everyone on the box. The underflow also permanently wedges further DMA maps for that container.

Who can reach it

Any container holding /dev/vfio/vfio and a group fd, using the legacy type1 container. The sequence is map DMA, exec() (the container fd survives), repeat. No host root, no special hardware, no race window to win.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: put a hard memory cgroup limit on tenants holding VFIO containers rather than relying on RLIMIT_MEMLOCK alone, and drop /dev/vfio from containers that do not need passthrough.

References